Reading Time: 2 minutesKey Takeaways:<\/p>\n
The breach was caused by a stolen private key, not a smart contract bug. The contract worked exactly as coded.
\nHacker granted themselves minting rights and created 1,000 unbacked eBTC, valued at roughly $76.7 million.
\nThe attacker used 45 fake eBTC as collateral on Curvance to borrow and clean around $821,000 via Tornado Cash.<\/p>\n
Echo Protocol on the Monad network has suffered a major security breach today, After an admin private key was compromised. The attacker unauthorizedly minted 1,000 eBTC (worth\u00a0 about $76.7 million), leaving the protocol with millions in unbacked tokens and creating bad debt for the Curvance lending platform.<\/p>\n
Echo Protocol (@EchoProtocol_) exploited on @monad
\nNOT a smart contract bug \u2014 admin private key compromise.
\nAttacker minted 1,000 eBTC out of thin air \u2192 used as Curvance collateral \u2192 borrowed WBTC \u2192 bridged out.
\nFull attack chain w\/ tx hashes \u2193
\n1\/ The key handover\u2026
\n\u2014 Marioo (@MarioY00) May 18, 2026<\/p>\n
Operational Failure Over Coding Errors
\nEcho Protocol became the victim of a high profile DeFi exploit, losing control of administrative functions. Blockchain security trackers confirmed that the attack wasn\u2019t caused by a smart contract vulnerability. Instead, the hacker managed to compromise a single Externally Owned Account (EOA) belonging to an old administrator. Using this stolen key, the attacker assigned themselves the highest administrative and minting roles, immediately revoking the original owner. With full control, the hacker minted 1,000 unbacked eBTC, which is worth about $76.7 million, in a process that required only a few cents in gas fees.
\nEcho Protocol on the Monad network has suffered a major security breach
\nRead Next: Thorchain Pauses All Trading After $10.8 Million Multichain Exploit
\nLaundering via Curvance and Tornado Cash
\nOnce the unbacked tokens were created, the hacker moved quickly to turn the synthetic assets into real capital. They deposited 45 of the fake eBTC as collateral into Curvance, a popular lending protocol operating on the Monad network. Because Curvance lacked a strict supply checking mechanism for new collateral, the system accepted the deposit, allowing the hacker to borrow 11.29 real Wrapped Bitcoin (WBTC). The attacker then bridged these assets to Ethereum, swapped them for ETH, and funneled approximately 385 ETH (around $821,000) into the privacy mixer Tornado Cash to clean the funds.
\nThe Fallout and Current Status
\nThe vast majority of the stolen assets, 955 eBTC remain sitting dormant in the hacker\u2019s wallet. However, because these tokens have no real Bitcoin backing them, the 45 eBTC used on Curvance has created a bad debt crisis for the lending platform\u2019s liquidity providers. Curvance has paused its eBTC markets to contain the damage. Monad co-founder Keone Hon quickly clarified that the underlying blockchain network remains completely safe, as the issue occurred strictly at the application layer.
\nRead Next: Arbitrum Freezes $71 Million in Stolen ETH After KelpDAO Exploit<\/p>\n","protected":false},"excerpt":{"rendered":"